Logic circuit having error detection function

Abstract: The present invention relates to a self-checking circuit and a method of its configuration. More particularly, it concerns a self-checking circuit useful for highly reliable system configuration. As for a logic circuit having error detection function that has function blocks (110,111) of feeding out a plurality of signals (430,431) at least duplexed, compares the output signals of the function blocks, and detects an error on the basis of results of the comparison, wherein the operations of the function blocks are delayed.

Description: The present invention relates to a redundant logical circuit or system that has function blocks provided with an identical function and at least dualized. Also, the present invention relates to a fault tolerant computer system in which such circuits or systems are used. Control systems for airplanes, trains, automobiles, and similar means of transportation are increasingly electrolysed as advanced control performances are needed to increase energy (fuel) efficiency, operationability, comfortability, and their speeds. To run the means of transportation safely, any of the control systems are forcefully required to be high in the reliability and the fail-safe performance that is no dangerous output is caused by occurrence of fault. To assure the reliability and fail-safe performance of the control system, it is important the control system to have a capability of detecting the occurrence of fault, that is, a self-checking capability. The effectiveness of conventional technology to achieve this is based on the presumption that the fault detected in either of the said at least dualized function blocks is independent of the other function block. In other words, it is premised that the same fault never occurs in both of at-least dualized function blocks at the same time. If the same fault occurs in both of the dualized function blocks at the same time, the fault output from both of the said dualized function blocks match and it becomes impossible to detect the fault by comparing them. This becomes a big problem when dualized function blocks are arranged in the same semi-conductor chip. A fault that occurs in either of at-least dualized function blocks due to electric noise, etc. can be prevented from affecting the others even when they are designed in the same way, by delaying the timings of their operations individually. And to material such a time diversity, the clock or input signal that decides the timing of a dualized function block operation is entered only to one of the dualized function blocks through a delay circuit. When comparing the output signals from those function blocks, only the signal from the other function block can be output through the delay circuit to compare it with that of the former function block in the comparison circuit. It is known from e.g. DE-B-2729362 to provide a redundant logical circuit with dualized function blocks, in which there is delay of signals. The present invention proposes a specific time delay which has been found advantageous. Thus, according to the present invention there is provided a redundant logical circuit or system that has function blocks provided with an identical function and at least dualized, wherein the operations of the said at least dualized function blocks are delayed by a certain time of period (T delay); wherein said time of period corresponds to an odd multiple of the half-cycle of the clock. Preferably, wherein the signal or clock to be entered to the first function block of the said at-least dualized function blocks is delayed by the said time of period (T delay), and the signal to be output from the second function block is delayed by the said time of period (T delay) and compared with the output from the first function block. The circuit or system may be one in which an output is output externally only when all the outputs from the said function blocks match and stops the output or outputs an output to external to guarantee the safe side operation when the outputs from the said function blocks do not match. The present invention may also provide a fault tolerant system with first and second circuits incorporating the redundant logical circuit defined above and a switching circuit that selects and outputs the output of either the said first circuit or the second circuit, wherein the said switching circuit selects the output according to the error detection signal from the said first or second logical circuit. The above and other objects, features and advantages of the present invention will be apparent from the following detailed description of the preferred embodiments of the invention in conjunction with the accompanying drawings, in which: Fig. 1 is an example of diversifying an operation time; Fig. 2 is another example of diversifying an operation time; Fig. 3 is still another example of diversifying and operation time. These embodiments are especially intending to materialize self-checking logics stated in chapter 1. Furthermore, by taking means called diversities as shown below, faults to be detected in any of at-least dualized function blocks can be prevented from affecting the other function block, improving the said effectiveness of the embodiments. The method to materialize such the diversities to be explained below can be combined with the self-checking comparison circuit 217 provided by Japanese Patent Laid-Open No. 27664/1994, to form a self-checking logical circuit or system. Of course, it can also be combined with other technologies to build a high reliability system such as a self-checking system, fault tolerant system, fail-safe system, etc. Faults that occur due to electric noise, etc. in any of said at-least dualized function blocks can be prevented from affecting the other function block even when both of the function blocks are designed in the same way, by delaying the timings of their operations individually. Figures 1, 2 and 3 show embodiments of a system to achieve such a time diversity. In the embodiment shown in Figure 1, only the clock signal 401 is entered to one B111 of the dualized function blocks through the delay circuit 420 that is set a delay time (T delay) to delay the operation timing. In this case, the output 431 from the function block B111 is delayed by a certain time of period (T delay) from the output 430 from the function block A110. Thus, the output 430 from the function block A110 is delayed by a certain time (T delay) using the delay circuit 421 so that outputs 430 and 431 are compared in the comparison circuit 217. In this embodiment, since the function blocks A110 and B110 can be operated at different timings from each other, malfunctions to be caused by power noise, etc. can be prevented from occurring concurrently in both function blocks A110 and B110. This allows a perfect self-checking logic to be realized by dualizing a function block and comparing outputs from both of the at-least dualized function blocks. When there are signals 410 and 411 to be entered the dualized function blocks A110 and B111, only the signal 401 may be entered to the function block B111 through the delay circuit 422 that is set a delay time (T delay) as shown in Figure 2. In this embodiment, any delay time (T delay) can be selected, but the delay time (T delay) should be as large as possible to minimize the correlation of faults between the function blocks A110 and B111. The speed up the operation and detection of faults, however, the delay time (T delay) should be as small as possible. In addition, to minimize the mutual influence of noise between the function blocks A110 and B111 considering that power noise in a digital circuit is generated in synchronization with clock signals, the delay time (T delay) should be set as follows. T delay = N+1/2 [clock cycle] N=0, 1... To satisfy both items(influence by noise and operation speed) therefore, it is found that the most suitable delay time (T delay) is ½ [of the clock cycle]. Figure 3 shows an embodiment of this invention, in which the delay time (T delay) is set to ½ [of the clock cycle]. The original clock signal 403 that has a frequency double the clock signals 400 and 401 of the dualized function blocks A110 and B111 is divided in the flip-flop 441 to become clock signals 400 and 401 whose phases are shifted by 180°, that is, ½ [of the clock cycle], from each other. They are then entered to the function blocks A110 and B111 separately. Input signals Insync and Inasync are entered to the function block A110 without delay. They are then entered to the function block B111 after they are delayed by ½ {of the clock cycle] in the flip-flops 444 and 445 (equivalent to the delay circuit 422). The input signal Insync is synchronized with the clock signal 400. The input signal Inasync is not synchronized with the clock signal 400. In other words, it is an asynchronous input signal. The Inasync signal is synchronized with the clock signal 400 in the flip-flop circuits 442 and 443. The output 430 from the function block A110 is delayed by ½ [of the clock cycle] in the flip-flop circuit 446 (equivalent to the delay circuit 421) and compared with the output 431 from the function block B111 in the comparison circuit 217. This invention provides a new method that assures the said fail-safe function even to cope with false signature to be caused by a short. No special constraint is needed to materialize failsafe logic circuits according to this invention. In addition, existing semi-conductor technologies, design automation tools, etc. can also be used effectively to reduce the cost and time of development significantly.

Claims: A redundant logical circuit or system that has function blocks (110,111) provided with an identical function and at least dualized, wherein the operations of the said at least dualized function blocks are delayed (420,421,422) by a certain time period (T delay); characterised in that : said time period corresponds to an odd multiple of the half-cycle of the clock. A redundant logical circuit or system according to Claim 1, wherein the signal or clock to be entered to the first function block (111) of the said at-least dualized function blocks is delayed (420) by the said time period (T delay), and the signal to be output from the second function block (110) is delayed (421) by the said time period (T delay) and compared (217) with the output from the first function block (111). A redundant logical circuit or system according to any one of the preceding Claims which is a fail-safe logic circuit or system that outputs an output to external only when all the outputs from the said function blocks (110,111) match and stops the output or outputs an output to external to guarantee the safe side operation when the outputs from the said function blocks do not match. A redundant logical circuit or system according to any one of Claims 1 to 3, with a fault detecting function for generating an error detection signal. A fault tolerant system provided with the first and second circuits, comprising the redundant logical circuit according to Claim 4 and a switching circuit that selects and outputs the output of either the said first circuit or the second circuit, wherein the said switching circuit selects the output according to the error detection signal from the said first or second logical circuit.

Inventors: KANEKAWA NOBUYASU, KEISUKE BEKKI, NOHMI MAKOTO, OHTSUJI SHINYA, SATO HIROSHI, SATO YOSHIMICHI, SHOJI SUZUKI, TASHIRO KOREFUMI, KANEKAWA, NOBUYASU, KEISUKE,BEKKI, NOHMI, MAKOTO, OHTSUJI, SHINYA, SATO, HIROSHI, SATO, YOSHIMICHI, SHOJI, SUZUKI, TASHIRO, KOREFUMI
Applicants: HITACHI LTD, HITACHI, LTD.
Application year: 1994
Main classification: G06F11
IPC codes: G06F11